# CVE-2026-40371: Microsoft Dynamics 365 privilege escalation

Source: https://junglewise.ai/threats/cve-2026-40371-microsoft-dynamics-365-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-40371 · Severity: high · CVSS 8.8 · Published 2026-06-09

Microsoft Dynamics 365 (on-premises) is a business application suite used for managing customer relationships and enterprise resources. A security vulnerability in this software allows an existing user with low-level access to gain higher-level administrative permissions. If exploited, an attacker could gain full control over the system, potentially leading to the theft of sensitive customer data or disruption of business operations.

Technologies: [Microsoft Dynamics 365 (on-premises)](https://junglewise.ai/threats/technologies/dynamics-365-on-premises). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-40371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40371 being exploited in the wild.

**How severe is CVE-2026-40371?** High severity, with a CVSS score of 8.8, published 9 June 2026.

**Which products and versions are affected?** Microsoft Dynamics 365 (on-premises).

**Is there a fix for CVE-2026-40371?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40371 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40371?** Check whether you run Microsoft Dynamics 365 (on-premises). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in Microsoft Dynamics 365 (on-premises) categorized as CWE-280 (Improper Handling of Insufficient Permissions or Privileges). The flaw allows an authenticated attacker with low-privileged access to bypass intended permission checks over a network connection. Successful exploitation enables the attacker to gain high-level privileges (equivalent to administrative access), granting them full confidentiality, integrity, and availability impact over the affected environment. Microsoft has released security updates to address this issue; users should refer to the MSRC update guide for specific patching instructions.

## Affected products

- Microsoft Dynamics 365 (on-premises)

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371)

## Related threats

- [Microsoft Dynamics 365 XML external entity injection](https://junglewise.ai/threats/cve-2026-122196-improper-restriction-of-xml-external-entity-reference-in)
- [Microsoft Dynamics 365 code injection](https://junglewise.ai/threats/cve-2026-42898-microsoft-dynamics-365-code-injection)
- [Microsoft Dynamics 365 code injection](https://junglewise.ai/threats/cve-2026-42833-microsoft-dynamics-365-code-injection)
- [Microsoft Dynamics 365 improper access control in on-premises version](https://junglewise.ai/threats/cve-2026-33103-microsoft-dynamics-365-improper-access-control-in-on-premises)